Somewhere in your agency there is a login for a premium form plugin, registered to an email address that belonged to a developer who left. Its licence key is active on a number of client sites. Nobody is quite sure which ones, when it renews, or whose card pays for it. It works, so nobody has looked.
Premium plugins and themes are one of those things that cause no trouble at all until suddenly they cause a lot. A licence lapses and updates stop. A client leaves and asks for “their” licence, which turns out to be yours. A vendor changes its terms and your developer licence no longer covers what you thought it did. None of these is hard to manage. They just need someone to manage them on purpose.
What a licence usually gives you
Most WordPress plugins and themes are released under the GPL, which allows the code to be used and modified. What you are usually paying for with a premium licence is access: the download, automatic updates through the dashboard, and support from the vendor. The exact terms vary by vendor, so read them for each product you rely on.
For most premium plugins, an expired licence does not switch the plugin off. The site keeps working. What it loses is the update feed, and that is the dangerous part, because security fixes arrive through updates. A site with a lapsed licence can sit on a vulnerable version for a long time without anyone noticing, because nothing visibly breaks. Some products do restrict features or stop working without an active licence, which is one more reason to know the terms of each.
The tempting shortcut, a nulled copy downloaded from a site offering premium plugins without payment, is not a shortcut. These files are a common source of malware; see why nulled plugins and themes carry malware before anyone on your team considers it.
Two ownership models, and when each fits
Every agency ends up choosing, deliberately or by accident, between two models.
The agency holds the licence
Many vendors sell multi-site or developer licences that cover a set number of sites or unlimited sites. You buy one, use it across clients, and include the cost in your project or care plan pricing.
This works well when:
- You maintain the sites yourself, so updates go through your hands anyway.
- You use a standard set of plugins across most clients.
- Your client agreement says clearly that the licence belongs to the agency and is provided as part of the service.
The risk is at the end of the relationship. When a client leaves, they lose access to updates from your licence, and they need to buy their own. If nobody told them that at the start, it feels like you are taking something away.
The client holds the licence
You buy the licence in the client’s name, or ask them to buy it, and register it to an account they own.
This works well when:
- The plugin is specific to that client, such as a booking or membership system.
- The client wants full ownership of everything on their site.
- You are building the site but not maintaining it afterwards.
The risk here is renewal. The client gets a renewal email, does not recognise the vendor name, and ignores it. Updates stop and nobody notices.
Mixing the two
Most agencies use both: agency licences for the standard toolkit, client licences for anything specific to one business. That is fine, as long as your records say which is which for every site.
Build a licence register
A simple register, kept up to date, solves most licence problems. A spreadsheet or your project management tool is enough. For each licence, record:
- Product name and vendor
- Licence type and how many sites it covers
- Account it is registered to, by email address, and where the login is stored
- Owner: the agency or a named client
- Who pays, and by what method
- Renewal date and whether it auto-renews
- Sites currently using it
- Sites the agreement says it may be used on, if the terms limit this
- Notes on vendor terms that matter, such as whether licences can be transferred
Register vendor accounts to a shared agency mailbox, not to one person’s address. When someone leaves, the account stays with the business.
Review the register on a set schedule. Check that the site counts are still within the licence, that renewal dates are coming up as expected, and that every client site on your books appears somewhere.
Renewals without surprises
- Put every renewal date in a shared calendar, with a reminder well ahead of time.
- For client-owned licences, tell the client before the renewal email arrives. A short note saying “you’ll get an email from [vendor] about renewing [plugin]; this is the one that runs your booking form, and it should be renewed” saves a lot of confusion.
- Decide before each renewal whether the plugin is still needed. Licences are a good prompt to review the stack.
- If a licence lapses by accident, renew it and then run the updates you missed, on staging first if the site has been behind for a while.
Keys, accounts and who can see them
A licence key is a credential. Anyone who has it can often activate the product on another site, using up your site allowance or breaching the vendor’s terms in your name. Treat keys the way you treat passwords.
- Store keys and vendor account logins in your team password manager, not in a project document or a chat thread.
- Do not paste agency keys into a client’s own notes or send them to the client, unless the licence is being transferred to them.
- When a freelancer or partner needs to activate a plugin, share the key through the password manager for that one client, or activate it yourself.
- When a staff member leaves, check whether they had access to vendor accounts, and change those logins.
Put licence terms in your client agreement
Most licence arguments are really arguments about what was agreed. Write it down at the start. A clause along these lines, adapted with your own legal review, covers the common cases:
“Premium plugins and themes used on the site are licensed either to the agency or to the client, as listed in the project documentation. Agency-held licences are provided as part of the ongoing service. If the service ends, the client will need to purchase their own licences to continue receiving updates and support for those products. Client-held licences remain the client’s property and responsibility to renew.”
This is a starting point, not legal advice; your own agreement should be checked by someone qualified where you operate.
Then tell the client in plain words, not only in the contract. A line in the proposal saying “we include licences for [products] while you’re on our care plan” is easier to remember than a clause.
When a client leaves
When a client moves on, licences are one of the items to hand over cleanly. For each premium product on their site:
- If the licence is theirs, confirm the account details and hand them over.
- If the licence is yours, tell them which products will need a new licence, and when your key will be removed.
- Deactivate your licence key on their site, so it no longer counts against your site limit.
- Note in the register that the site is no longer covered.
Give the client a reasonable notice period before deactivating anything, so they are not left without updates in the middle of the move. The rest of the offboarding process is covered in our guide to ending a client relationship cleanly.
Keep the stack small
The easiest licence to manage is the one you do not need. Every premium plugin adds a renewal, an account and a set of terms to track. Agencies that standardise on a short list of tools they know well have far fewer of these problems, and their updates go more smoothly too. Our article on standardising plugins and themes across client sites goes into how to choose that list.
Before adding a new premium plugin to a client site, ask:
- Is there something already in our standard stack that does this?
- Who will own the licence?
- Is the vendor active, with recent updates and clear terms?
- What happens to the site if this licence lapses?
A short audit to run this month
- List every premium plugin and theme across every site you look after.
- For each, find the licence it uses. Anything you cannot trace is a gap.
- Check for sites showing “licence inactive” or similar notices in the dashboard.
- Check for any site where premium plugins have pending updates they cannot install.
- Move any vendor account registered to a personal address onto a shared agency one, if the vendor allows it.
It is an unglamorous afternoon. It tends to find at least one site that has been quietly missing updates.
Licences are a small part of the larger question of who does the routine work on client sites; the guide to WordPress outsourcing for agencies covers that question as a whole. If you would rather hand off the update side, with licence status checked as part of every update run, our page on tested plugin and core updates for agency clients explains how we work.
Next in this series: How Agencies Manage Multiple WordPress Sites
